Comparing hardened container images
If you are looking for a Chainguard alternative, a Minimus alternative, a replacement for the deprecated Bitnami images, or simply a free source of hardened base images, this section is the honest version: the same scanner, the same database, the same day, published with the raw dataset and with the images where Minimal comes off worse left in.
Minimal vs Chainguard
16 version-matched images with a free, publicly pullable Chainguard equivalent. Minimal lower on 3, tied on 11, higher on 2.
Minimal vs Docker Hardened
Docker released 1,000+ hardened images free under Apache-2.0 in December 2025. Where a small MIT-licensed catalog still makes sense — and where it does not.
Replacing Bitnami images
Bitnami's free versioned images moved to an unmaintained legacy repo in August 2025. Free replacements for 64 of the most-used ones — and the gaps where there is none.
Minimal vs Minimus
81 version-matched images compared. Minimal lower on 74, tied on 6, higher on 1.
Minimal vs distroless
0 version-matched runtime images compared. Minimal lower on 0, tied on 0, higher on 0.
Which one should you actually use?
Reach for Minimal if you want a small, auditable catalog — 150 images, every recipe MIT-licensed and in one public repo — at no cost, with no account and no paid tier, and you are willing to trade catalog breadth for that.
Reach for a commercial vendor if you need thousands of images, a support contract, FedRAMP or STIG paperwork, SLSA Build L3, or someone contractually obliged to answer the phone. Those are real requirements and this project does not meet them. Minimal publishes SLSA v1.0 Build L2 provenance, and says so rather than rounding up.
Why publish the losses
Because a comparison you cannot check is worth nothing. Every version-matched row where Minimal carries more findings is shown with the same prominence as the wins. The raw CSV and version classifications are published so you can recompute all of it, and the method is stated so you can disagree with it precisely.
Scan date 2026-10-15 · Grype 0.109.1 · full dataset:cve-comparison-2026-10-15.csv · version-matched pairs:cve-comparison-pairs-2026-10-15.csv